Straitly compass logostraitly
Sign up
Get started

API keys & authentication

Use a Straitly API key to authenticate inference requests. Keep account keys on your server, give each application its own key, and set spending limits before sharing access.

Create a key

  • Sign in, verify your email, and open API keys. Your account role must allow key creation.
  • Give the key a descriptive name such as prod-api or local-dev. Set a daily spend cap if appropriate.
  • Store the raw key securely when it is returned. The console stores a hash rather than a recoverable plaintext copy.
  • New keys can take about 15 seconds to activate. If a newly created key returns 401, wait briefly and check again before replacing it.
Manage API keys

Send your key

Set the environment variable in the same terminal or server process that runs your application. The example below lists available models without sending an inference request.

Terminal
export STRAITLY_API_KEY="YOUR_STRAITLY_API_KEY"

curl https://api.straitly.ai/v1/models \
  -H "Authorization: Bearer $STRAITLY_API_KEY"

PowerShell uses $env:STRAITLY_API_KEY="YOUR_STRAITLY_API_KEY". Never place the key in a URL query string.

Store it safely

  • Use your hosting provider's secret store in production. A local .env file should be excluded from version control.
  • Do not expose an account key in frontend JavaScript, screenshots, support messages, or public repositories.
  • A key can authorize more than inference, including account tools such as MCP. Only give it to clients you trust.
  • Use distinct keys for environments and applications so a revoked development key does not interrupt production.

Replace or revoke a key

For a planned replacement, create a new key, wait for activation, update the application secret, and verify a request. Revoke the old key after confirming consumers have switched.

For a leaked key, revoke it immediately and investigate Activity. Removing it from a repository or chat does not invalidate copies someone may already have.

Child keys have a separate rotation API with an optional grace period. Do not assume ordinary account-key replacement has the same API contract.

Child-key rotationRequest activity

Troubleshoot authentication

  • 401: check the active key, bearer header, and server environment. Remove accidental whitespace and confirm the key is not revoked.
  • 403 while creating keys: verify your email and account permissions. Partner-key minting requires separate account enablement.
  • 402: authentication may be valid but credits or a spending cap are exhausted. Replacing the key is not the right fix for an account balance issue.
Errors & limitsHelp & community
Quickstart